I'm not suggesting we do that at all. I'm disagreeing with Dan Walsh and
suggesting that the IPv6 attack surface is smaller if we use kernel module
options.
On Mon, May 13, 2013 at 11:06 PM, Shawn Wells <shawn(a)redhat.com> wrote:
On 5/13/13 7:32 PM, Jeffrey Blank wrote:
Yes. One of these should go.
We have this, but it states that this sysctl causes "almost all of the
calls into the module" to be disabled.
https://bugzilla.redhat.com/show_bug.cgi?id=641836#c17
So the kernel module option seems stronger. And would suggest we delete
both sysctls. Perhaps somebody from Red Hat engineering can offer an
opinion.
Nice BZ link -- didn't know about the level of integration.
Created
https://fedorahosted.org/scap-security-guide/ticket/408 to track
the creation of XCCDF against the sysctl_net_ipv6_conf_all_disable_ipv6
Anyone want to grab that ticket? Actually, if someone has been thinking
about diving into content creation, I'd be happy to step through the
process with them.
_______________________________________________
scap-security-guide mailing list
scap-security-guide(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide